Native apps cannot hold the loggedin_session cookie, but both platforms expose the browser's shared cookie jar: ASWebAuthenticationSession on iOS, Custom Tabs on Android. The SDKs make one visible, consented trip through it, and the worker exchanges that proof for a signed token carrying the same session id. Everything afterwards is a plain HTTPS call.

No device identifier is involved. No permission, entitlement, or MDM is required, and the app ends up on the same session as mobile Safari or Chrome on that device.

Platform	Library	Shared cookie jar via
iOS	ios/	`ASWebAuthenticationSession`
Android	android/	`CustomTabsIntent`

Protocol #

Bootstrap — open in the shared-cookie browser:

GET {service}/app/start?origin={appOrigin}&callback={callback}&state={random}[&did={did}]

origin must serve /oauth-client-metadata.json, and callback must appear verbatim in that document's redirect_uris. Passing did runs the "remember this account" confirmation instead of the chooser.

The page redirects to the callback with ?state=…&token=…[&did=…], or ?state=…&denied=1 if the person declines. Reject any callback whose state you did not generate.

Afterwards — send X-Loggedin-Token: <token>:

Call	Endpoint
List hints	`GET /xrpc/fyi.loggedin.account.list`
Heartbeat	`POST /xrpc/fyi.loggedin.account.loggedIn` with `{"did":…}`
Forget	`POST /xrpc/fyi.loggedin.account.logout` with `{"did":…}`

Do not send origin in the body. The token pins it, and a mismatch is rejected with 403.

401 means the token is expired or invalid. Discard it and bootstrap again. Tokens live at most 7 days, matching the hint TTL.

Worker configuration #

The bootstrap endpoint is disabled (501) until a signing secret exists:

npx wrangler secret put DEVICE_TOKEN_SECRET

Use at least 32 random characters. Rotating it invalidates every outstanding token, and apps re-bootstrap on their next call.